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(57) Abstract: A secure system 
and method for online commercial 
transactions involving the transfer of 
funds in exchange for merchandise or 
services is disclosed where consumers 
(40) are given an opportunity to execute 
anonymous on-line transactions. 
Consumers anonymously pay for 
merchandise or services with the same 
convenience as credit card payments, by 
providing a public code to a participating 
merchant and a secret code to the System 
Vendor (10) at the time of the purchase. 
The public code and secret code may 
be, in a preferred embodiment, obtained 
by the consumer upon purchasing, with 
traditional currency if desired, a card 
with a specific denominational value. 
The card, in the preferred embodiment, 
functions as the vehicle of conveyance 
of the public and secret codes, with an 
activation code associated with the card 
for providing a mechanism of additional 
security. 
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System And Method For Secure Anonymous Online Commercial Transactions 

Field of the Invention 

This invention relates to the general field of electronic commercial 
transactions, and more particularly, to a payment system that allows commercial 
transactions to take place securely online between purchasers who may remain 
anonymous and merchants. 

Background of the Invention 

The use of commercial transactions over the Internet (often referred to as 
"e-commerce") has grown tremendously over the last few years and is expected to 
continue growing for the foreseeable future. As on-line security measures have 
improved, consumers have become more comfortable providing credit card as well as 
other sensitive personal (e.g., financial) information on-line. None-the-less, there are 
still a number of reasons consumers may not wish to engage in on-line transactions. 

Concerns that, for example, less reputable merchants accepting the credit 
card information may misuse the information or simply not deliver the goods promised, 
or that sensitive financial information (e.g., a credit card number) may be "intercepted" 
by third parties during transmission leave many consumers wary of engaging in online 
transactions where the potential for fraud still exists. On other hand, in most instances, 
the use of a credit card for on-line transactions allows both the merchant and the credit 
card company to identify the purchaser and the purchase. In these cases, a consumer 
may simply wish to conduct a transaction anonymously or, perhaps the consumer does 
not want a certain transaction to appear on his or her credit card statement. 

Additionally, many consumers, for a variety of reasons, do not have 
credit cards. Some consumers have no credit or bad credit and are unable to obtain 
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credit cards, while others, minors in particular (who constitute a significant pool of 
potential consumers), often do not have credit cards by virtue of their age. This pool of 
consumers without credit cards are thereby precluded from benefiting from on-line 
transactions. 

Presently, most merchants do not accept other available types of 
electronic payment. Since these present alternative electronic payment systems are not 
widely accepted, they do not offer an acceptable alternative to credit cards. 
Additionally, most electronic payment systems do not provide complete anonymity, 
since the providers of these services will know the identity of the user, even if the 
merchants participating in these payment methods do not. Further, present electronic 
payment systems often involve high transaction costs that are usually borne by the 
purchaser. 

For most practical purposes, there are presently no alternatives to the use 
of credit (or debit) cards for online transactions. Although a few merchants do accept 
personal checks or other forms of payment by mail, such transactions are inconvenient 
and provide additional risks to both parties (e.g., if payment is not received by the 
merchant or a check is not adequately funded) adding delays in order processing and 
risk of financial loss to what would otherwise be nearly instantaneous and essentially 
"risk free" consummation of a transaction. 

Summary of the Invention 

The present invention relates to a secure system and method for online 
commercial transactions involving the transfer of funds in exchange for merchandise or 
services. Under the present invention, consumers are given an opportunity to execute 
anonymous on-line transactions. To this end, consumers anonymously pay for 
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merchandise or services with the same convenience as credit card payments, by 
providing a public code to a participating merchant and a secret code to the System 
Vendor at the time of the purchase. The public code and secret code may be, in a 
preferred embodiment, obtained by the consumer upon purchasing, with traditional 
currency if desired, a card with a specific denominational value. The card, in the 
preferred embodiment, functions as the vehicle of conveyance of the public and secret 
codes, with an activation code associated with the card for providing a mechanism of 
additional security. 

An object of the invention is to provide an electronic payment system 
that allows consumers to remain anonymous. 

Another object of the invention is to provide an electronic payment 
system that eliminates or reduces the credit risk of an online transaction. 

Yet another object of the invention is to provide an electronic payment 
system that eliminates or reduces the security risk of an online transaction. 

Still another object of the invention is to provide an electronic payment 
system that offers a convenient way for consumers without credit cards to make online 
purchases. 



and a secret code, wherein both codes are associated with an account having a balance 
that may be transferred to another card having a different public code and secret code. 

Brief Description of the Drawings 

The foregoing and other features and advantages of the present invention will 
become more apparent in light of the following detailed description of exemplary 
embodiments thereof, as illustrated in the accompanying drawings, where: 



A further object of the invention is to provide cards having a public code 
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Figures 1 A and IB show the front and back respectively of an 
illustrative example of the IT'SCASH™ transaction card of the preferred embodiment 
of the present invention. 

Figure 2 is a diagram of a network connection between a consumer, 
distributor, merchants, and system vendor according to the preferred embodiment of the 
present invention. 

Figure 3 is a system level flowchart implemented in the network of 
Figure 2 according to the preferred embodiment of the present invention. 

Figures 4A and 4B is a detailed flowchart of the system level flowchart 

of Figure 3. 

Figure 5 is an illustrative implementation of a user-system in the present 

invention. 

Figure 6 is an illustrative preferred implementation of the System 
Management Computer in the present invention. 

Detailed Description of the Invention 

In a preferred embodiment of the present invention, an on-line 
transaction card, the front and back of which are illustrated in Figures 1A and IB 
respectively, is utilized as the vehicle of distribution of the public and secret (or 
"private") codes of the present invention (as will be discussed in more detail below) 
where the secret code remains non-disclosed during the distribution process. In this 
embodiment, the physical card is implemented as the IT'SCASH™ card available from 
the assignee of the present invention. Most conveniently, the physical card offers the 
tangible experience of exchange that resembles the familiar experience of exchanging 
actual currency. While implemented in this preferred embodiment by means of a 
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physical transaction "card", the present invention can be implemented in alternative 
embodiments using alternative vehicles of conveyance of account data (as will be 
discussed infra) to a consumer forgoing the use of an actual physical card, an example 
of such alternative vehicles is discussed with respect to Figure 2. 



according to this embodiment, will bear a public code 10 and a secret code 12 on the 
back of the card (Fig. IB). The public code corresponds to an account number as will 
be described with respect to Figures 3 and 4. The secret code is similar to a PIN 
(Personal Identification Number) and is conveyed to the purchasing Consumer in a 
hidden format, for example, under a removable coating such as a scratch-away coating. 
Each public code 10 will have a unique corresponding secret code 12. (The public code 
and its corresponding secret code are also referred to herein as a "code pair".) Although 
not critical to the invention, in this embodiment, the card is conveniently manufactured 
as illustrated in Figure 1 A in incremental face value amounts 14 corresponding to values 
of standard currency bills shown on the face of the card (e.g., $20, $50, $100, etc.). 



and is intended for use by the retail Distributor of the card. As will be described in 
detail, the Licensed Distributor will, over a secure link to the System Vendor, send the 
public code, the corresponding activation code and distributor identifying information to 
the System Vendor. The activation code can be individual to a particular card (i.e., and 
therefor the corresponding public code or account) or the activation code can be for a 
batch or series of cards (corresponding to several or a series of public codes or 
accounts). The card, in alternative embodiments, bear the activation code, or a part of it, 
in which case it would preferably be in a non-human readable format (e.g., a bar code 



As shown in Figure 1A/B, the physical on-line transaction card 1, 



An activation code (not shown) is utilized as a fraud prevention feature 
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format) because if the activation code is simply reproduced on the card face in easily 
readable human format, its effectiveness in fraud prevention would be significantly 
reduced. 

In Figure 2 is illustrated a network implementation of the invention 
system according to the preferred embodiment of the present invention. In a preliminary 
set up stage, System Vendor 10 will establish a network of Licensed Distributors 20 and 
Authorized Merchants 30 who, along with a Consumer 40, will form the system 
environment. Criteria for authorizing or licensing are established by the System 
Vendor. While no minimum criteria is necessary (with respect to authorization and 
licensing) to practice the present invention, a System Vendor will normally establish 
criteria with an eye to the finances and/or reputation of a particular Merchant or 
Distributor, the types of products a Merchant vends, or a System Vendor can choose 
alliances which are totally subjectively based. Once these entities are chosen, the 
network implementation is as follows. 

In this implementation, a secure communications link 15 is established 
between System Vendor 10 and Distributor 20 and secure link 25 between System 
Vendor 10 and Merchant 30. Consumer 40 is connected to Merchant 30 by a link 35, 
and to System Vendor 10 by a secure link 55, both, for example, over the Internet. If 
desired, in an alternative embodiment, a secure or non-secure link (via Internet access) 
50 to System Vendor 10 can be offered to Consumer 40 as a customer support device to 
allow Consumer 40 to, e.g., check account balances, provide recourse in the event of 
problems with card operation or to report difficulties or problems encountered with 
participating Distributors or Merchants. There is no requirement, however, that such 
customer service link 50 be provided in order to practice the invention. For example, in 
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alternative embodiments, Consumer 40 is not provided with such a communication link 
50 to System Vendor 10, but merely a Customer Service Telephone Access Number can 
be provided (e.g., a toll free "800 number). 



implemented in the preferred embodiment but is rather a "manual" link similar to any 
retail store purchase by a consumer- Consumer 40 obtains a transaction card 80 from 
Distributor 20 by simply going to a Distributor and paying with currency to acquire the 
card. While in the preferred embodiment the link 45 between Consumer 40 and 
Distributor 20 is a "traditional merchant-consumer" one, various configurations as can 
be devised by those skilled in the art consistent with the teachings of the present 
invention in alternative embodiments where, for example, a Consumer 40 can purchase 
on-line transaction accounts directly from System Vendor 10 via secure Internet 
connection 50. This type of configuration would be useful, for example, to allow a 
credit card bearing Consumer to purchase e.g., 10 public code accounts (each of which 
would be represented as a transaction card purchase) with the System Vendor sending 
10 public code/secret code pairs back to the purchasing Consumer for distribution or use 
at the purchasing consumer's discretion. The purchasing Consumer could then, for 
example, give a public/secret code pair to a non-credit card bearing consumer as a "gift 
certificate" type transaction. While forgoing their anonymity with the System Vendor 
for the code pair purchase, the purchasing Consumer could none-the-less use the 
public/secret code pair himself in lieu of a credit card to perform anonymous 
transactions on line according to the teachings of the present invention. 

Alternatively, an electronic communications link 15 between Distributor 
20 and System Vendor 10 is not required in all embodiments of the present invention. 



Link 45 between Consumer 40 and Distributor 20 is not electronically 
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All such necessary communications can be performed via conventional methods 
(telephone for example.) 

Illustrated in Figure 3 is a system level flowchart implemented on the 
network of Figure 2 which flowchart sets out phases of the present invention according 
to the preferred embodiment. 

The several phases of the system of the preferred embodiment of the 
present invention include: Phase 100- Account Generation , Phase 200- Card 
Manufacture, Phase 300- Card Distribution, Phase 400- Card Acquisition, Phase 500- 
Transaction, Phase 600- Clearance, and Phase 700- Delivery. 

In Phase 100, the Account Generation Phase, System Vendor 10 creates 
a unique "account" which are utilized as the transaction vehicle in the present invention. 
The account is identified by a public code which is essentially an account number. In the 
preferred embodiment, an online transaction card is generated for that account number 
and a secret code is generated to correspond to each particular public code or account. 

. The card which will accordingly be manufactured (see Phase 200) and 
issued will bear the code pair (i.e., the public code and corresponding secret code). 
System Vendor 10 also determines the individual or series activation code for an 
individual card or a series of cards, respectively, and thus for the corresponding 
respective accounts. 

In Phase 200, the Card Manufacture Phase, the online transaction card is 
manufactured by Card Manufacturer 60 (Figure 2) (which can alternatively be the 
System Vendor) for each individual account generated in Phase 100 according to 
specifications established by System Vendor 10. 
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In Phase 300, the Card Distribution Phase, the transaction card is 



distributed by System Vendor 10 to Licensed Distributors 20 for retail sale to individual 
Consumers 40. As described above, the Distributor 20 and System Vendor 10 will 
typically have an established communication channel between them, which can easily 
be implemented via the Internet, for activation purposes and for financial reconciliation. 

In Phase 400, Card Acquisition, the transaction card is purchased by the 
Consumer 40. In the preferred embodiment, there is no association between a particular 
card account and any particular Consumer 40 who may purchase that card as the 
purchase is made in currency. This acquisition process is similar to that which occurs in 
the purchase of telephone calling cards with the consumer remains anonymous for all 
stages of a given transaction. The Distributor 20 must reconcile (financially) with 
System Vendor 1 0 for the total value of cards sold. (Note that equally for the alternative 
embodiment described above where the transaction card account (i.e., a code pair) may 
be purchased (or "opened") with a credit card, the use of the card will still remain an 
anonymous transaction as to the actual on-line user of the code pair.) 



Authorized Merchants 30 via an Internet connection and close the desired transaction in 
a secured area established by the Merchant 30. Consumer 40 (electronically) provides 
the public code to the Merchant 30. Merchant 30 in turn forwards the Consumer 40 
provided information (i.e., the public code) along with Merchant data including the 
amount of a given transaction and data that identifies the Merchant 30 to System 



Vendor 10 over a secure link to the System Vendor. Consumer 40 will then provide 
the secret code to the System vendor 10, directly or by means of a software 
component installed on the merchant secure web server. 



In Phase 500, Transaction, Consumer 40 will access the desired 
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In Clearance Phase 600, financial reconciliation between an Authorized 
Merchant 30 and the System Vendor 10 occurs. System Vendor 10 verifies validity of 
Merchant information (i.e., participation), authenticity of data, validity of the code 
pair and balance in the code pair account. System Vendor 10 will transfer requested 
amounts from Consumers 40 account with System Vendor 10 to the Merchant's 30 
account with System Vendor 1 0, notifying the Merchant 30 through a secure process 
with an authorization or validation code for that transaction. Prior to such transfer, 
transaction fees are deducted by System Vendor 10 from the Consumer's account 
and/or from Merchant's amount due similarly as is done by conventional credit card 
services for credit card annuity and purchase discounts. 

If the transaction which has been closed is an "irreversible" transaction 
(i.e., no refunds allowed or a final sale) then System Vendor 10 will transfer funds 
from the Merchant's account with System Vendor to any account designated by 
Merchant (e.g., the Merchant's commercial banking account). If, on the other hand, 
the transaction is "reversible" (i.e., it has not matured to the level of irreversible), the 
System Vendor will hold the funds in the Merchant's account until the transaction 
becomes irreversible before transferring funds to the account designated by Merchant. 

In Phase 700, Delivery of Goods, the Merchant will arrange to deliver 
the purchased goods in appropriate fashion- either over the Internet or by shipping 
avenues. 

Referring now to Figures 4A/4B, the phases of the preferred embodiment 
enumerated in Figure 3, are illustrated in detail. The flowchart depicted represents a 
detailed implementation of the online commercial transaction system according to the 
preferred embodiment of the present invention. Different functions are assigned to 
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Consumer 40, Authorized Merchant 30, Licensed Distributor 20, Card Manufacturer 60 
and System Vendor/Clearinghouse 10 for the various phases as shown. 

In Account Generation Phase 100, System Vendor/Clearinghouse 10 
generates 102 account numbers (i.e., public codes) and corresponding secret codes. 
Transaction cards are assigned to or associated with 104 the code pairs (public and 
secret) and activation codes. 

In phase 200, transaction cards are manufactured 202 accordingly as 
specified by System Vendor with public and secret codes that correspond to each 
account. Preferably, the manufacture of cards is out-sourced to a Card manufacturer 60, 
however, manufacture can be performed by System Vendor 10 as well. In the preferred 
embodiment of the invention, the secret codes are covered by an opaque removable 
layer (e.g., a scratch-off layer) which is to be removed by the Consumer after purchase 
and prior to use to reveal the secret code. 

In phase 300, System Vendor 10 distributes 302 the cards to Licensed 
Distributors 20. Distributor 20 requests card activation 304 from the System Vendor 10 
by transmitting the public code and the activation code along with data identifying the 
Distributor. Upon verification of the information received, System Vendor 10 will 
activate 306 the corresponding card or cards. 

In Card Acquisition phase 400, Consumer 40 acquires 402 a transaction 
card by paying to the Licensed Distributor 20 the face value amount on the card. 
Payment may be made in cash or by other payment method. Upon receipt of payment, 
Licensed Distributor 20 deposits 404 the payment equivalent amount into the account 
associated with the card by sending the payment amount to the System Vendor 10 less 
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commission. Once Consumer 40 has physical possession of the card, Consumer 40 
removes 406 the opaque protective layer, revealing the secret code printed on the card. 

With reference now to Figure 4B, in Transaction phase 500, after 
deciding on a particular transaction with an Authorized Merchant 30, Consumer 40 
closes the desired transaction by transmitting 502 the public code associated with the 
card to the Authorized Merchant 30. 

Authorized Merchant 30 forwards 504 (directly or through the Consumer 
40), in a secure form, transaction information to System Vendor 10 which includes the 
public code along with the amount to be deducted from the account associated with the 
card. The Consumer 40, then provides 508 the secret code to the System Vendor 10 via 
secure link 55, and thereby authorizes Merchant 30 to deduct a certain amount from the 
card account. System Vendor 10 compares the public and secret codes and validates 
510 the transaction, creating a validation code (which can be a numeric code or a simple 
yes/no approval or rejection) if both codes are associated with an account having a 
balance greater than the amount to be deducted. (Multiple cards can be used by similar 
process where the purchase price exceeds the face value of a given card.) System 
Vendor 10 returns 512 validation code to Authorized Merchant 30. 

In Clearance phase 600, System Vendor 10 transfers 610 credit to the 
Merchant's account when a transaction has become "irreversible" by deducting the 
authorized amount from the account associated with the code pair and crediting the 
account of the Authorized Merchant 30 with the authorized amount minus a transaction 
fee. The Authorized Merchant 30 and the System Vendor 10 will have an agreed upon 
protocol for determining when a transaction is deemed "irreversible". For example, the 
System Vendor can agree with a particular Authorized Merchant that transactions will 
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Merchant that the transaction is deemed irreversible immediately. The irreversibility 

criteria can be established, for example, by the type of goods or service provided by the 

Merchant depending upon when delivery of the goods or service is effected to the client. 

System Vendor 10 effects payment 612 to Authorized Merchant 30 of irreversible 

transaction funds either periodically at predetermined time intervals or when an 

Authorized Merchant's account reaches a predetermined level. Pending irreversibility of 

a transaction, money is held by System Vendor on account for the particular Authorized 

Merchant. 

Alternatively, an Authorized Merchant can (electronically) notify the 
System Vendor of a transaction becoming irreversible, thus allowing the System Vendor 
to release funds upon notification. 

In Delivery phase 700, after having received 512 the validation code 
from the System Vendor 10, Authorized Merchant 30 delivers 702 the goods or, 
alternatively, provides the service, being purchased by Consumer 40. Consumer 40 
receives 704 the goods delivered 702 by Authorized Merchant 30. 

With reference to Figure 5, there is shown a block diagram of user 
system 530. The end-user communicates with other connected members of the data 
network illustrated in Figure 2 via end-user computer 550. In the preferred 
embodiment, end-user computer 550 is implemented as a conventional personal 
computer having: a CPU 560, input device 588 (e.g. a keyboard and/or mouse), input 
output capabilities 580 (including components known in the art to effect connection of 
and to peripheral devices including modem 581, input device (most commonly a 
keyboard) 588 and video monitor 585), memory 570 (including RAM 571, ROM 572 
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and data storage device 573) and bus 540. Data storage device 573 may be 
implemented as, for example, a hard drive as is known and/or a floppy or CD-ROM 
drive for reading from/writing to removable media (e.g., a floppy disk or CD-ROM). 
End-user computer 550 communicates with the other members of the system network 
via communications link 590 through modem 581. It will be understood that 
communications link 590 can represent the respective communications links 15, 25, 
35 50 and 55 illustrated in Figure 2. While shown as being implemented via modem 
581, in alternative embodiments, other communication devices such as a network card 
or direct Internet connection as are known can be utilized to enable direct 
communications as will be understood. 

While implementation for any of the systems of the individual 
members of the system network of the preferred embodiment (System Vendor 10, 
Licensed Distributor 20, Authorized Merchant 30 and Consumer 40) can be 
implemented using the user system of Figure 5, it will be understood by those skilled 
in the art that hardware requirements may vary and each member may implement 
variations of the illustrative user system of Figure 5 as required to meet their 
individual requirements. For example, while the System Vendor system may in fact 
be implemented as in the illustrative embodiment of Figure 5, an implementation such 
as illustrated in Figure 6 may be preferable. 

Figure 6 depicts a preferable embodiment of the System Management 
Computer 650 which would be deployed by System Vendor 10. This System manages 
communications with System Vendor 10 by Licensed Distributor 20, Authorized 
Merchant 30 and Consumer 40 via communications link 690 (the respective 
communications links 15, 25, 50 (Figure 2)). System Management Computer 650 can 
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be implemented as a conventional mainframe computer, workstation, or personal 
computer depending upon the throughput requirements (which will likely be measured 
simply by the volume of transactions expected to be handled by the system). System 
Management Computer 650 includes CPU 660, communications port 681, secure 
processor 695, code generator 697, RAM 671, ROM 672, data bus 640, and data 
storage device 670. For high volume transaction processing a more powerful 
microprocessor with a 32-bit data bus such as the Intel Pentium® series processors or 
a RISK architecture microprocessor with a 64-bit data bus may be used as CPU 660. 
Data storage device 670 may be, e.g., an array of hard disk drives, a conventional hard 
drive as is known and/or a floppy or CD-ROM drive for reading from/writing to 
removable media (e.g., a floppy disk or CD-ROM) and is used to store the various 
databases used to implement the present invention, such as an Account database 673 
(for tracking the code pairs, activation codes and account balances); Merchant 
database 674 which contains Merchant related data (e.g., Merchant accounts including 
Merchant identification information); and Distributor database 675 (e.g., card log for 
tracking card distribution). It will be understood by those skilled in the art that each 
of the individual databases may be relational to one another, or that all of them may 
be combined into a single database. Code generator 697 is used for generating public, 
secret and activation codes. Secure processor 695 is used for secure communications 
between System Vendor 10 and Authorized Merchant 30. 

It will further be understood by those skilled in the art that alternative 
system architectures, for example, which use portable devices such as the Palm 
Pilot®, can be equally implemented in application of the principles and features of the 
present invention. 
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The foregoing description was presented to enable any person skilled 
in the art to make and use the invention. Descriptions of specific applications are 
provided only as examples. Variations and/or modifications to the preferred 
embodiments will be readily apparent to those skilled in the art, and the general 
principals defined herein may be applied to other embodiments and applications 
without departing from the spirit and scope of the invention. Thus, the present 
invention is not intended to be limited to the embodiments shown, but is to be 
accorded the widest scope consistent with the principles and features disclosed herein. 
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Claims 

1 . A method for conducting anonymous on-line transactions comprising the steps of: 

generation by a system vendor of a code pair, including a public code and a 
secret code, corresponding to a user account held with the system 
vendor; 

allocation of the code pair to a consumer, the proceeds of which allocation are 

used to fund the user account; and 
effecting an anonymous on-line transaction between the consumer and a 

merchant where the public code is communicated from the consumer to 

the merchant and the secret code from the consumer to the system 

vendor. 

2. The method of claim 1 further comprising the steps of: 

communication by the merchant of the public code and the charge amount of 
the anonymous on-line transaction to the system vendor for 
reconciliation against the corresponding user account; 

communication by the consumer of the secret code to the system vendor; 

verification by the system vendor of sufficient balance in the user account to 
cover the charge amount; 

confirmation by the system vendor to the merchant of the sufficient balance; 

transfer by the system vendor of the charge amount to a merchant account held 
with the system vendor; and 

disposition by the system vendor of the charge amount as determined by the 
merchant. 

3. The method of claim 1 wherein the step of allocation of the code pair to a 
consumer includes: 

generation by the system vendor of a transaction card for each code pair, said 
transaction card bearing the code pair; and 

distribution of the transaction card to the consumer. 

4. The method of claim 3 wherein the step of distribution of the transaction card to 
the consumer is performed by an intermediary. 
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5. The method of claim 1 further including the steps of: 

generating at least one activation code associated with said code pair; and 
activating said code pair by communicating said activation code to said system 

vendor. 

6. The method of claim 2 wherein said confirmation is via a validation code 
communicated by said system vendor to said merchant. 

7. The method of claim 2 wherein said disposition is to an external account specified 
by the merchant. 

8. The method of claim 2 wherein, prior to the step of disposition by the system 
vendor of the charge amount as determined by the merchant, the merchant notifies the 
system vendor that the on-line transaction has become irreversible. 

9. A system for conducting anonymous on-line transactions between a consumer, a 
merchant and a system vendor, the system comprising: 

means for generating a code pair, including a public code and a secret code, 
corresponding to a user account held with the system vendor; 

means for allocating the code pair to the consumer, the proceeds of which 
allocation are used to fund the user account; and 

means for effecting an anonymous on-line transaction between the consumer 
and the merchant where said public code is communicated from the 
consumer to the merchant and the secret code from the consumer to the 
system vendor. 

10. The system of claim 9 further comprising: 

means for communicating the public code and the charge amount of the 

anonymous on-line transaction by the merchant to the system vendor 
for reconciliation against the corresponding user account; 

means for communication of the secret code by the consumer to the system 
vendor; 

means for verifying by the system vendor a sufficient balance in the user 
account to cover the charge amount; 
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means for confirming by the system vendor to the merchant of the sufficient 
balance; 

means for transferring by the system vendor of the charge amount to a 
merchant account held with the system vendor; and 

means for disposing by the system vendor of the charge amount as determined 
by the merchant. 

1 1 . The system of claim 10 further comprising means for notifying the system vendor 
that the on-line transaction has become irreversible. 

12. The system of claim 9 wherein the means for allocating the code pair to a 
consumer includes: 

means for generating by the system vendor a transaction card for each code 
pair, said transaction card bearing the code pair; and 

means for distributing the transaction card to the consumer. 

13 The system of claim 12 herein the means for distributing the transaction card to 
the consumer is an intermediary. 

14. The system of claim 9 further including: 

means for generating at least one activation code associated with said code 
pair; and 

means for activating said code pair by communicating said activation code or 
codes to said system vendor. 

1 5. The system of claim 9 wherein the means for communication of the secret code 
by the consumer to the system vendor is by means of a secure link. 

16. The system of claim 15 further including second means for communication by the 
consumer to the system vendor. 
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